The United States Department of the Treasury’s Office of Foreign Assets Control (OFAC) has announced a major crackdown on the financial infrastructure of the notorious transnational criminal organization Tren de Aragua (TdA). On September 30, 2026, federal authorities designated ten high-level targets and identified seven cryptocurrency addresses linked to a sophisticated multi-million dollar money laundering operation. At the center of this investigation is Anibal Alexander Canelon Aguirre, a man known by the alias "Prometheus," who currently occupies a position on the FBI’s Ten Most Wanted Fugitives list.
The enforcement action exposes a complex nexus between traditional physical bank robberies and modern digital asset laundering. According to federal investigators and blockchain analytics firm Chainalysis, Aguirre and his associates engineered a scheme that utilized "ATM jackpotting" to steal tens of millions of dollars from American financial institutions, subsequently funneling those proceeds through a global network of cryptocurrency wallets to support TdA’s operations across the Western Hemisphere.
The Rise of Tren de Aragua and the "Prometheus" Connection
Tren de Aragua, which originated as a prison gang in the Aragua state of Venezuela, has rapidly evolved into a formidable transnational criminal organization. In February 2025, the U.S. State Department officially designated TdA as a Foreign Terrorist Organization (FTO), citing its involvement in drug trafficking, human smuggling, extortion, and various forms of financial fraud. The group’s expansion into the United States has been marked by a shift toward high-tech crimes that provide high yields with relatively low immediate physical risk compared to traditional street crimes.
Anibal Alexander Canelon Aguirre, or "Prometheus," is alleged to be the technological architect behind TdA’s most lucrative American ventures. Wanted for bank fraud, burglary, money laundering, and providing material support to terrorists, Aguirre is credited with developing and deploying the specialized malware used to compromise automated teller machines. His ability to bridge the gap between physical intrusion and digital exploitation made him a priority target for the FBI and international law enforcement agencies.
The Mechanics of ATM Jackpotting: The Ploutus Malware
The primary method of theft employed by Aguirre’s network is a cyber-physical attack known as "ATM jackpotting." Unlike traditional skimming, which steals individual customer data, jackpotting targets the machine’s internal operating system to force it to dispense its entire cash reserve without debiting any legitimate bank account.
According to a December 2025 indictment, the TdA cells utilized a highly coordinated three-phase operational structure to execute these attacks:
- Surveillance and Reconnaissance: A specialized crew would identify target ATMs, typically those in low-security areas or with known hardware vulnerabilities. They would photograph the machines and check for "silent hood alarms"—security sensors that alert authorities when the ATM’s outer casing is opened.
- Physical Breach and Infection: Once a target was deemed viable, an installation team would physically break into the ATM. They would briefly remove the machine’s hard drive to install the "Ploutus" malware strain, often utilizing Raspberry Pi devices as the interface. Once the infected drive was reinserted, the malware would gain control over the machine’s dispensing mechanism.
- Collection and Erasure: A third "money mule" crew would arrive to collect the dispensed cash. The Ploutus malware featured a sophisticated self-delete function, which erased all traces of the software and the intrusion logs immediately after the cash was dispensed, significantly hindering forensic investigations.
As of August 2025, the Department of Justice reported that this specific conspiracy resulted in losses totaling $40.73 million across more than 1,500 separate attacks throughout the United States.
Cryptocurrency: The Modern Laundering Rail
While the theft was physical, the movement of the stolen funds was almost entirely digital. OFAC’s recent designation highlighted seven specific cryptocurrency deposit addresses at a major exchange that were used to receive and move the proceeds of the jackpotting attacks.
Chainalysis, which has been tracing the on-chain footprint of Aguirre and his associates, found that the TdA network did not operate in a vacuum. Instead, they leveraged "shared laundering infrastructure"—a system where multiple criminal organizations use the same illicit brokers and wallets to clean their money. The investigation revealed that TdA’s wallets had significant exposure to known money laundering operations based in Mexico, Colombia, and Venezuela.
"The on-chain insights show us that criminal organizations are leveraging common infrastructure for laundering," stated Kaitlin Martin, a Senior Intelligence Analyst at Chainalysis. "These are insights that only the blockchain can provide, allowing us to see how TdA’s funds mingle with those of Colombian and Mexican drug cartels."
The network relied heavily on stablecoins, specifically USDT (Tether), to move funds across borders. Stablecoins provide the criminal organization with the price stability of the U.S. dollar while maintaining the speed and pseudonymity of blockchain transactions. However, this reliance also proved to be a vulnerability. Because stablecoins are often managed by centralized entities, law enforcement can request the freezing of assets. Indeed, Tether has already moved to freeze USDT balances on several wallets identified as having exposure to the now-sanctioned addresses.
The Designated Associates
The OFAC action on September 30 did not only target Aguirre but also six of his primary lieutenants and associates who facilitated the movement of funds and the management of the operational cells. The designated individuals include:
- Carlos Javier Martinez Armenta: Alleged to have managed the logistics for the installation crews.
- Alejandro Mejia Castillo: Linked to the recruitment of money mules in the U.S.
- Jose Dario Galeano Bazurto: Suspected of coordinating with Colombian laundering networks.
- Eric Gabriel Cardenas Arzola: Identified as a technical assistant in malware deployment.
- Oscar Leonardo Martinez Pirona: Alleged to be a primary liaison between the U.S. cells and TdA leadership in Venezuela.
- Anthony Wuiliam Hernandez Guerrero: Involved in the conversion of physical cash into digital assets.
These individuals are now blocked from the U.S. financial system, and any assets they hold within U.S. jurisdiction must be frozen and reported to OFAC.
Chronology of Enforcement Actions
The dismantling of the Aguirre network is the result of a multi-year effort by the U.S. government. A timeline of the major milestones includes:
- February 2025: The U.S. State Department designates Tren de Aragua as a Foreign Terrorist Organization, unlocking broader legal powers for federal investigators.
- August 2025: Financial institutions report that losses from jackpotting attacks have surpassed the $40 million mark, triggering an intensified FBI search for the malware’s creator.
- December 2025: A federal grand jury indicts Aguirre and his associates on charges of bank fraud, burglary, and providing material support to a terrorist organization.
- Early 2026: Chainalysis and other private sector partners begin identifying the specific cryptocurrency addresses used by the TdA network to move funds between the U.S. and Latin America.
- September 30, 2026: OFAC officially sanctions the network, designating ten individuals and seven crypto addresses, effectively cutting off their access to major exchanges.
Broader Impact and Policy Implications
This case serves as a landmark example of the evolving nature of transnational organized crime. The integration of cyber-expertise into traditional gang structures like Tren de Aragua poses a significant challenge to global financial security. The use of shared laundering infrastructure suggests that criminal groups are becoming more collaborative, sharing resources to evade detection by national authorities.
The Treasury Department’s focus on cryptocurrency addresses as part of its sanctions regime marks a shift in how the U.S. government combats illicit finance. Since 2025, the administration has taken over 30 actions against more than 300 individuals and entities tied to transnational criminal organizations, with an increasing number of these actions involving digital assets.
For financial institutions and cryptocurrency exchanges, the TdA case underscores the necessity of advanced blockchain monitoring. As criminal groups route more funds through crypto, compliance teams must be able to identify not just the primary sanctioned addresses, but also the secondary and tertiary wallets that interact with them.
The ongoing search for Anibal Alexander Canelon Aguirre remains a top priority for the FBI. While the sanctions have successfully crippled his ability to move money through transparent channels, he remains at large, potentially possessing the technical skills to develop new iterations of the Ploutus malware. Law enforcement officials emphasize that the international community must remain vigilant as TdA continues to seek new ways to exploit the intersection of physical infrastructure and the digital economy.
